CVE-2021-4034

Name
CVE-2021-4034
Description
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
NVD Severity
medium
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
MISC https://access.redhat.com/security/vulnerabilities/RHSB-2022-001
MISC https://bugzilla.redhat.com/show_bug.cgi?id=2025869
MISC https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683
Exploit http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html
Third Party Advisory http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html
Third Party Advisory https://www.suse.com/support/kb/doc/?id=000020564
MISC https://www.oracle.com/security-alerts/cpuapr2022.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:polkit_project:polkit:*:*:*:*:*:*:*:* polkit == None == None

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
polkit edge-community 0.120-r2 Natanael Copa <ncopa@alpinelinux.org> fixed
polkit 3.15-community 0.119-r8 Natanael Copa <ncopa@alpinelinux.org> fixed
polkit 3.12-main 0.116-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable